Academia

Design a model that would estimate the economic properties of a proposed identity management solution. The model should be able to estimate return of investment, total cost of ownership and also other economic properties.

Design a model that is using data from an identity management system to estimate the cost of services for a specific employees and/or employee groups. E.g. the model should be able to calculate the cost of services provided by IT department to other departments. The IDM system can provide reasonably reliable data about the service usage, licensing cost and also the data about sharing of system operational cost which may lead to a better cost data.

Design and create a system that will be able to automatically suggest a solution to software problems. E.g. it should be able to analyze log records that are copied to the system by an engineer. The system should be able to look through a knowledge base, mailing lists, documentation and other resources. It should be able to suggest a solution based on the retrieved information, suggest a correct documentation or at least provide a list of relevant resources to investigate.

Design and prototype a system that processes audit log records and provides a practical and convenient tools for (forensic) analysis of the records. It should be able to correlate related records and present them in a meaningful way. The system should be able to answer questions such as what access privileges an employee had three months ago?, Who has access to this part of a system a week ago?. The system should also be interactive, e.g. it should be able to quickly search through the records, refine the searches and so on.

Design and prototype a model for a complete life-cycle of RBAC roles. The solution should be able to manage the life-cycle from role definition proposal, approvals, deployment, reviews and decommission. The system should be able to estimate the impact of new or changed role definition on existing system, it should be able to estimate risks. The solutions should enforce regular role reviews and so on.

Design and create an interactive system that can be used for efficient customization and development of Identity Management solution. The system should be based on Integrated Development Environment (IDE) principles and in fact could be implemented as a set of plug-ins for existing IDEs (such as Eclipse). The system should efficiently support the tasks frequently done during IDM solution desgin, customization, testing and deployment.

Design and prototype a system that will use data from existing Identity Management system to search for patterns and propose improvements in RBAC structure. The system should be able to propose new roles or changes to existing roles. E.g. it should analyze groups of users with similar attributes and/or access rights.

Design and create a subsystem that will visualize configuration of Identity Management (IDM) system. The IDM systems deal with synchronization of data among many sources and targets. Create a subsystem that can visualize the data path and transformations along the paths. Such subsystem should be aimed at system administrators that review and update the configuration therefore it should be able to (at least partially) modify the configuration or at least point to the IDM native configuration tools. The secondary goal is to support diagnostics therefore it should also contain some debugging and data visualization tools. The suggested form of solution is interactive Web application or an IDE plugin.

The OAuth-based protocols (OpenID Connect, UMA) are a good choice for cloud access management. But they almost completely lack the identity management features. There is no way how to synchronize identities, how to deprovision or pre-provisioning accounts, no mechanisms that would support reasonable local cache coherency, etc. The goal is to extend the OAuth protocol with an identity management functionality and implement a prototype. The ideal environment for the prototype would be a ConnId connector in midPoint.